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(57) Abstract: Methods and arrangements are provided for handling, within a communications system comprising a distributed 
domain (301) and a central domain (303), electronic records that contain predictions of the outcome of a certain incident. Within 
the distributed domain (301) there is generated (304), before the outcome of the incident is known, a multitude of electronic records 
that contain predictions of the outcome of the incident. The electronic records arc conveyed (305) from the distributed domain (301) 
to the central domain (303). After the outcome of the incident is known, the central domain (303) finds out (306) which of the 
electronic records, if any, contain correct predictions of the outcome of the incident. Each of the electronic records is furnished (304, 
401, 502. 902. 1202, 1911), within the distributed domain (301), with a cryptographically protected proof of a certain moment of 
time associated with the generation of the electronic record. The central domain (303) accepts (306, 1430, 201 1) only those of the 
electronic records conveyed thereto as valid for which the cryptographically protected proof of a certain moment of time associated 
with the generation of the electronic record shows that said certain moment of time was not later in time than a certain time limit. 
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Methods and arrangements for realising betting with off-line tei^ninals 



The invention concerns generally the technological field of betting and/or gambling 
with the help of electronic communications systems. Especially the invention 
5 concerns the use of off-line teraiinals to play a game where the actions of the 
players must be accomplished according to a certain timetable. 

Betting can be generally defined as an activity where a number of participants ti7 to 
predict the outcome of a certain well-defined incident, such as e.g. a sports event, an 

10 election or simply the arbitrary drawing of a small group of numbers or other 
symbols (in the latter case the terms "lotto" or "lottery" are more commonly used 
than "betting"). Typically placing a bet means putting down a certain sum of money 
or other commodity of value, so that those who succeeded in predicting the outcome 
of the incident in question get their investment back with a certain profit that is 

15 financed from the collected stakes of the unsuccessful participants. An important 
feature of betting is that all bets must be placed before a certain time instant after 
Vv'hich it would be possible to know the result or anticipate it with an increased level 
of certainty. 

20 In a manual betting system where all bets must be placed before an officer of the 
organiser of the game it is easy to take care of the timing aspects of betting. The 
counter which accepts the bets closes at the moment after which no more bets are 
accepted, and opens again for paying the profits after the outcome of the incident is 
known. In electronic betting arrrangements the situation is somewhat more 

25 complicated. 

Fig. 1 illustrates a known system for so-called online betting where bets can be 
placed basically anywhere where a suitable communication connection exists. The 
system comprises a number of betting terminals, of which 101, 102, and 103 are 

30 shown. A communications network 104 links the terminals to the premises 105 of 
the organiser of the game. A central database 106 is provided there for storing the 
bets. A hot backup database 107 duplicates all operations made in the main database 
106, and a cold backup database 108 is ready to replace any of the main or hot 
backup databases in a case of a detected failure. The purpose of using at least one 

35 backup database is to ensure that the probability of losing information due to an 
eventual failure in the main database is sufficiently low. Schematically shown in 
Fig. 1 as 109 are means for figuratively cutting the connection between the database 
106 and the network 104 as a response to a certain clock signal. 
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In the system of Fig. 1 there is, in addition to the players and the organiser, also a 
third party 110, which is typically a governmental supervisory body. The third party 
has its own database 111 for storing yet another backup copy of the betting 
5 information or at least some sununarising information thereof. A communications 
connection 112 links the third party's database 111 to the main database 106 of the 
organiser. The communications connection 112 could also go through the 
communications network 104. The task of the third party is to enhance the players' 
confidence to the game by ensuring that the organiser does not modify the bets after 
1 0 they have been placed. 

The operation of the system of Fig. 1 is illustrated in Fig. 2. At step 201 a player 
places a bet at one of the temiinals. The terminal transmits the bet in electronic form 
202 through the conmiunications network to the main database, where it is received 

15 and stored at step 203. The main database acknowledges the reception and storing of 
the bet by transmitting an acknowledgement message 204 to the terminal. The hot 
backup database stores copies of the bet and the acknowledgement message at step 
205 at the latest; duplication to the hot backup database may also take place 
inunediately after each single receive, store and/or transmit operation occurring in 

20 the main database. As a proof of the placed bet the terminal prints a receipt 206 to 
the user. The steps 203, 204, 205 and 206 constitute a so-called transaction: they 
must all succeed or all fail together. Otherwise the system might end up in a state 
where there exist different conceptions of who has or may have obligations to 
whom. 

* 

25 

After a certain moment of time, which in Fig. 2 is designated as 207, no more bets 
are accepted, meaning that all eventual later attempts of transmitting bets from the 
terminals to the main database would be turned down by the latter. In the 
arrangement of Fig. 1 this means that the cutting means 109 are used to isolate the 
30 main database from the connections to the terminals. At step 208 the main database 
composes a summary of all legally placed bets, which it transmits at step 209 to the 
third party's backup database. After that the actual incident that was the object of 
betting may begin at step 210. 

After a later time instant 211 when the outcome of the incident has become known, 
35 the winning players may collect their profits. At step 212 the player of Fig. 2 
presents his receipt to the terminal. At step 213 the terminal transmits to the main 
database a request for an authorisation for paying out the profit. The main database 
must ensure that no profit is paid out more than once, so at step 214 it marks the bet 
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for which the request was made as paid. At step 215 it transmits the authorisation 
message to the terminal. Copies of the request and authorisation messages are stored 
into the hot backup database at step 216. After having received the audiorisation the 
terminal pays the profit to the player at step 217. Steps 214, 215, 216 and 217 
5 constitute again a transaction. 

The use of electronic money and electronically maintained accounts may cause 
some changes to the system of Fig. 1 and the method of Fig. 2. In one altemative 
embodiment of known electronic betting the organiser maintains, together with the 
10 databases described above, a player database where each player has a playing 
account. In that case the player does not need to pay his bets at the terminal: he only 
instructs the organiser to deduct the price of his bet(s) from his account. After the 
incident the organiser may automatically credit the accounts of those players the bets 
of which entitled them to profits. 

15 

A feature common to all known electronic betting systems is their relative slowness 

in rpceWina fhe b^t*2 l^^TOR h^ttina QVQternQ rnns^" a<^cent '=^ven fePS nf TTiilli'^ns of^^f^t^ 

concerning a single incident. Even when very fast conununications and storage 
technology are used, there exists a limit for the rate at which the bets can be 

20 communicated and stored into the central database. This feature has limited the 
applicability of the whole principle of betting so that the incidents the results of • 
which are objects of betting are themselves rather large and long lasting, Uke a 
complete football game or a complete horse race. With the prior art arrangements of 
the above-described kind it is not possible to reaUse for example a situation where, 

25 in the middle of football world cup finals, the result of a comer would suddenly be 
declared an object of betting. In that case all bets should be placed during the 15 
seconds or so that it takes from the referee's whistle to the moment when the 
player's foot hits the ball at the corner flag. 



30 It is an object of the present invention to present a method and an arrangement for 
arranging electronic betting with potentially very short time cycles. It is another 
object of the invention to present a method and an arrangement for electronic 
betting with good scalabiUty into very small and very large groups of potential 
players. It is yet another object of the invention to present a method and an 

35 arrangement for electronic betting with reasonable requirements concerning 
dedicated hardware. 
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The objects of the invention are achieved by using offline terminals for betting so 
that a secure clock signal is used to label a bet before it reaches a central database. 

The method applies to a method for handling, within a communications system 
5 comprising a distributed domain and a central domain, electronic records that 
contain predictions of the outcome of a certain incident, the comprising the steps of: 

- generating, within the distributed domain and before the outcome of the incident is 
known, a multitude of electronic records that contain predictions of the outcome of 
the incident, 

10 - conveying the electronic records from the distributed domain to the central domain 
and 

- within the central domain and after the outcome of the incident is known, finding 
out which of the electronic records, if any, contain correct predictions of the 
outcome of the incident; 

15 it is characteristic to the method that it comprises the steps of: 

- furnishing, within the distributed domain, each of the electronic records with a 
cryptogi-aphically protected proof of a certain moment of time associated v/ith the 
generation of the electronic record and 

- accepting, within the central domain, only those of the electronic records conveyed 
20 thereto as valid for which the cryptographically protected proof of a certain moment 

of time associated with the generation of the electronic record shows that said 
certain moment of time was not later in time than a certain time limit. 

The invention applies also to a method for handling, within a. terminal arrangement 
25 that belongs to the distributed domain of communications system comprising a 
distributed domain and a central domain, electronic records that contain predictions 
of the outcome of a certain incident, the method comprising the steps of: 

- generating an electronic record that contains a prediction of the outcome of the 
incident and 

30 - transmitting the electronic record to the central domain; 

this embodiment of the invention is characterised in that it comprises the step of: 

- furnishing the electronic record, before transmitting it to tiie central domain, with a 
cryptographically protected proof of a certain moment of time associated with the 
generation of the electronic record. 

35 



The invention applies also to a method for handling, within a computer system that 
belongs to the central domain of a communications system comprising a distributed 
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domain and a central domain, electronic records that contain predictions of the 
outcome of a certain incident, the method comprising the steps of: 
-receiving from the distributed domain a multitude of electronic records that 
contain predictions of the outcome of die incident and 

5 - after the outcome of the incident is known, finding out which of the electronic 
records, if any, contain correct predictions of the outcome of the incident; 
this embodiment of the invention is characterised in that it comprises the step of: 
- accepting only those of the electronic records received from die distributed domain 
as valid for which a cryptographically protected proof of a certain moment of time 

10 associated with the generation of the electronic record shows that said certain 
moment of time was not later in time than a certain time limit. 



The invention applies also to a terminal arrangement for handling electronic records 
that contain predictions of the outcome of a certain incident, comprising: 
15 - bet record generation means for generating an electronic record that contains a 
prediction of the outcome of the incident and 

- transmitter means for transmitting the electronic record to a central domain; 
it is characterised in that it comprises: 

- means for furnishing the electronic record, before transmitting it to the central 
20 domain, with a cryptographically protected proof of a certain moment of time 

associated with the generation of the electronic record. 

The invention applies also to a computer system for handling, within the central 
domain of a communications system comprising a distributed domain and a central 
25 domain, electronic records that contain predictions of the outcome of a certain 
incident, comprising: 

- receiver means for receiving from the distributed domain a multitude of electronic 
records that contain predictions of the outcome of the incident and 

- processing means for finding out, after the outcome of the incident is known, 
30 which of the electronic records, if any, contain correct predictions of the outcome of 

the incident; 

it is characterised in that it comprises: 

- discriminating means for accepting only those of the electronic records received 
from the distributed domain as vahd for which a cryptographically protected proof 

35 of a certain moment of time associated with the generation of the electronic record 
shows that said certain moment of time was not later in time than a certain time 
limit. 
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Additionally the invention applies to an arrangement for handling, within a 
conununications system comprising a distributed domain and a central domain, 
electronic records that contain predictions of the outcome of a certain incident, 
comprising: 

5 - within the distributed domain means for generating, before the outcome of the 
incident is known, a multitude of electronic records that contain predictions of the 
outcome of the incident, 

- means for conveying the electronic records from the distributed domain to tlie 
central domain and 

10 - within the central domain means for finding out, after the outcome of the incident 
is known, which of the electronic records, if any, contain correct predictions of the 
outcome of the incident; 

■ 

it is characterised in that it comprises: 

- within the distributed domain means for furnishing each of the electronic records 
1 5 with a cryptogi'aphically protected proof of a certain moment of time associated with 

the generation of the electronic record and 

- within the central domain means for accepting only those of the electronic records 
conveyed thereto as valid for which the cryptographically protected proof of a 
certain moment of time associated with the generation of the electronic record 

20 shows that said certain moment of time was not later in time than a certain time 
limit. 

The prior ait requirement for using a central database as the storage location of the 
decisive copy of each bet record arises from the need of preventing cheats: it must 

25 be ensured that a dishonest participant can not wait until some moment after the 
official closing time, use his acquired knowledge about the outcome that was the 
object of betting, and place a bet that would still appear to have come in time. 
According to the invention there is provided a different way of coupling each bet 
with the exact moment of time at which it was made, or more accurately coupling 

30 the bet with the knowledge that the bet was made before a certain time instant. 
Betting terminals, or at least some distributed data processing entities that are not 
located at any central database, are arranged to compose bet records that are self- 
sustaining in the sense that each bet record as such can be later decoded to reveal 
both the placer and content of the bet and whether or not the bet was made in time. 

35 In this patent application we will refer to such bet records as time-stamped bet 
records. 
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The implementation of time-stamping means usually that the device which perfonns 
the time-stamping is equipped with a clock and means for converting certain 
information given by the clock into an encrypted message from which it is 
impossible for unauthorized parties to deduce the conversion algorithm. 
5 Alternatively the clock signal may come from some other device to the device that 
perfonns the actual time-stamping. Most advantageously the clock signal itself is 
encrypted, and/or the clock signal generator is located within a protected structure 
that prevents dishonest users from tampering with the clock. It is also possible to use 
a terminal for composing the bet record and another device to time-stamp it. 

10 

The principle of generating the self-sustaining bet records "locally", i.e. outside the 
central database, does not place any limitations to the number or rate of placing bets. 
After the bet records have been generated there is a certain time during which they 
must be communicated into the system of the organiser of the game in order for 

15 them to be acknowledged. The organiser's system decodes each bet record, checks 
the time stamps and accepts only those bet records for which the time stamp shows \ 
that the bet was made in time. Those players are credited the accepted bets of which ; 
matched the acaial outcome of the incident. Additionally each accepted bet causes . 
the organiser* s system to deduct the stake, i.e. the price of the bet, from the account . 

20 of the player who placed the bet. 

The procedure of locally generating bet records and communicating them into a 
central database requires the betting terminal to have some data processing and 
communicational capabilities. These requirements together with the object of 

25 keeping the need of dedicated hardware at a reasonable level suggest that the 
terminals of known two-way communications systems could be used as betting 
terminals. Indeed, many known communications systems such as cellular radio 
networks and bidirectional digital television networks offer very advantageous 
possibiUties to the application of the invention. These networks enable rapid general 

30 broadcastings in the downlink or forward direction to large numbers of terminals, as 
well as collection of relatively short messages in the uplink or reverse direction from 
large numbers of terminals to a central location during a longer time. The terminals 
of the existing communications networks are already a part of the everyday life of 
potential users of the betting airangement of the invention, which smoothens the 

35 way from the abstract idea of the invention into practical applications. The terminals 
even already possess some features of user- and/or network controlled 
programmability, which makes it easy to distribute the software components 
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required in the terminals to those users that want to use their terminals as betting 
terminals of the arrangement according to the invention. 

The novel features which are considered as characteristic of the invention are set 
5 forth in particular in the appended claims. The invention itself, however, both as to 
its construction and its method of operation, together with additional objects and 
advantages thereof, will be best understood from the following description of 
specific embodiments when read in connection with the accompanying drawings. 

10 Fig. 1 illustrates a known arrangement for electronic betting. 
Fig. 2 illustrates a known method for electronic betting, 
Fig. 3 illustrates a principle of off-line electronic betting, 
Fig. 4 illustrates the generation of a time-stamped bet record according to an 
embodiment of the invention, 
15 Fig. 5 illustrates the generation of a time-stamped bet record according to 

another embodiment of the invention. 
Fig. 6 illustrates the principle of a system where the main operations take place 

in a terminal and at the organiser's server, 
Fig. 7 illustrates a variation of the system of 6 where an intermediary time- 
20 stamper is used. 

Fig. 8a illustrates a variation of the system of 6 where a distant auxiliary time- 
stamper is used, 

Fig. 8b illustrates a variation of the system of 6 where a local auxiliary time- 
stamper is used, 

25 Fig. 9 illustrates an arrangement for implementing time-stamping with an 

internal source of a clock signal, 
Fig. 10 illustrates a variation of the system of Fig. 6, 
Fig. 11 illusti'ates another variation of the system of Fig. 6, 
Fig. 12 illustrates an arrangement for implementing time-stamping with an 
30 external source of a clock signal. 

Fig. 13 illustrates a system architecture for an arrangement according to an 

embodiment of the invention, 
Figs 14a to 14c illustrate a method according to an embodiment of the invention, 
Fig. 15 illustrates an advantageous message structure used within the method of 
35 Figs 14a to 14c, 

Fig. 16 illustrates another advantageous message structure used within the 
method of Figs 14a to 14c, 
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Fig, 17 illustrates another advantageous message structure used within the 

method of Figs 14a to 14c, 
Fig. 18 illustrates another advantageous message structure used within the 

method of Figs 14a to 14c, 
5 Fig. 19 illustrates a method executed by a terminal according to an embodiment 

of the invention and 

Fig. 20 illustrates a method executed by an organiser's system according to an 
embodiment of the invention. 

10 Figs. 1 and 2 were described in the description of prior art, so the following 
description of the invention and its advantageous embodiments focuses on Figs. 3 to 
20. Like parts in the drawings are designated with the same reference designators. 

Fig. 3 illustrates a principle where the parties that take part in the betting are divided 

15 into a distributed domain 301, a network 302 and a central domain 303. We assume 
that a game of betting involves a large number of participants as well as an 
organiser who runs the game, i.e. collects the bets, calculates the profits according 
to the outcome of the incident which was the object of betting, and arranges the 
distribution of stakes so that the winning players can collect their profits and the 

20 losing players lose their stakes. The players as well as the (advantageously personal) 
electronic terminals they use for taking part in the betting belong clearly to the 
distributed domain 301. The computerized system that the organiser uses to manage ' 
his part of the procedure belongs to the central domain 303. The task of the network 
302 is to act as a channel of information exchange between the distributed domain 

25 301 and the central domain 303. Actually the "network" concept reaches both to the 
distributed domaui 301 and to the central domain 303, because each terminal that is 
used for betting constitutes a terminal node in the network, and the system of the 
organiser constitutes a central node in the network. Due to the large number of 
terminals and the small mmiber of organiser's system nodes the network 302 

30 resembles a tree-like structure where the root of the tree is at the organiser's system 
node(s) and numerous branches are directed therefrom towards the players' 
terminals. 

According to the principle of off-hne electronic betting, the generation of bet 
35 records within the distributed domain 301 involves the additional feature of time- 
stamping each bet record so that at any later time instant it is possible to determine, 
by looking at the bet record, whether or not the bet record was produced before a 
certain instant of time and whether or not the bet record has been modified after its 
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generation. The generation and time-stamping of bet records is generally designated 
in Fig. 3 as step 304. When such a bet record is transmitted towards the central 
domain 303, it is the task of the network 302 to provide means for both 
authentication and non-repudiation of the time-stamped bet record. Authentication 
5 means in this context that the true identity of both the original transmitter and the 
final receiver are known. Non-repudiation means that the original transmitter of the 
time-stamped bet record cannot later deny having transmitted the record. Other 
important security features which the network 302 should advantageously provide 
are integrity and confidentiality, meaning that the contents of the time-stamped bet 
10 record are not modified in transit and diat unauthorised parties are prevented from 
detecting, who sent what to whom. The transmission of the time-stamped bet record 
through the network is generally designated in Fig. 3 as step 305. 

The system of the organiser, located within the* central domain 303, must receive, 

15 decode and verify the time-stamped bet record at step 306. The difference between 
online and off-Une electronic betting is that in the latter, step 306 can take place at 
any time before or after the closing time (the moment after which the outcome of the 
incident is either known or possible to anticipate, with an increased level of 
certainty). In Fig. 3, the system of the organiser checks the time stamp of each 

20 received bet record and accepts only those bet records into the game in which the 
time stamp reveals that the bet record was generated before the closing time. 
Additionally flie system of the organiser checks at step 306 that the bet record came: 
from its authenticated transmitter and that the contents thereof were not modified 
after its generation. After the outcome of the incident which was the object of 

25 betting is known, the system of the organiser converts at step 307 those bets which 
succeeded in anticipating the outcome into payment orders that credit the winning 
players. Additionally the system of the organiser deducts the placed stakes from the 
accounts of the players who placed bets. The last-mentioned step emphasises the 
importance of non-repudiation: a player who placed a non- winning bet must not be 

30 able to withdraw his bet after the closing time. 

The level of security against cheating that is to be reached is typically in proportion 
to the value of obtainable prizes. In a recreational game or form of entertainment for 
children, where no monetary value is involved, little or no security measures are 
35 needed since the number of players is supposedly small and the organiser may 
expect everybody to play along the rules. If and when the invention is applied for 
gambhng, i.e. applications where money or other commodities of value can be 
obtained by placing successful bets, security must receive careful consideration. 
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Different embodiments of the invention may be presented where different numbers 
of security measures are introduced. 

In a maximum-security embodiment we must assume that even if a dishonest user is 
5 able to completely disassemble a terminal arrangement and break the codes that 
protect that part of the associated software that is stored within the terminal 
arrangement, security of the system must still not be endangered. This means that 
the successful execution of such operations by the terminal arrangement that are 
sensitive in the sense of system security must completely depend on information 

10 coming from outside the terminal arrangement. Some examples: if the terminal 
arrangement stores infoimation in encrypted form, such cryptographic keys should 
be used which the terminal arrangement receives from somewhere else. If the 
terminal arrangement is to measure time, the measurement must at least indirectly 
depend on some external clock signal. If success or failure in a certain procedural 

15 step depends on some piece of information either definitely existing or definitely not 
existing in the terminal arrangement, the condition for using such information must 
come from outside the terminal arrangement. 

In achieving maximal security it also helps if there exists a mechanism tiiat enables 
20 the checking of integrity of data and program code as well as the correctness of local 
clock readings in the distributed domain. For example, the terminal arrangement 
may tiansmit encrypted reports of its status according to a given schedule. The 
terminal arrangement and/or the software running therein may also combine factors 
that describe the order and number of appeared incidents as well as their time of 
25 appearance. A broadcast type regular transmission from a trusted source may be 
used as an external clock that makes it unnecessary to generate local clock signals in 
environments sensitive to tampering. It is also advantageous to have die terminal 
itself implement a relatively low amount of encrypting and decrypting if reverse 
engineering of these operations would be of assistance in breaking a larger entity of 
30 security coding in the system. 

Figs. 4 and 5 illustrate certain possibilities of generating time-stamped bet records 
with appropriate features for authentication, non-repudiation, integrity and 
confidentiality considerations. From tiie field of digital cryptography there is known 
35 the concept of unidirectional algorithm, which means an algorithm which is easily 
performed into one direction in reasonable time but which is practically impossible 
to reverse without knowing a certain cryptographic key. In Fig. 4 a unidirectional 
algorithm 401 is used to convert the actual contents of the bet and a certain clock 
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signal into a bet record that is authenticated by encrypting it with a private key of 
the player placing the bet and encrypted with the pubhc key of the organiser. As a 
part of the conversion a checksum is calculated and added into the bet record. The 
result is an authenticated, encrypted and time-stamped bet record that can only be 
5 decrypted with the private key of the organiser. The authentication based on the 
player's private key can only be reversed with the same player's public key. 
Recalculating the checksum and comparing it against the checksum contained in the 
bet record serves as a check against later modifications. 

10 Fig. 5 illustrates a similar principle of producing a secure time-stamped bet record 
with the difference that in Fig. 5 the procedures of generating the bet record and 
time-stamping it have been divided into two algorithms 501 and 502. These two 
algorithms may even be performed in two different devices so that the first device 
generates the bet record, calculates the checksum(s), authenticates the bet record 

15 with the player's private key and encrypts it with the organiser's public key. The 
time-stamping device does not need to know the contents of the encrypted bet 
record, i.e. it does not need to be able to decrypt it. It suffices that the time-stamper 
uses a clock signal to make a certain addition to the authenticated, encrypted bet 
record and re-authenticates it with its own private key. It may additionally re-enci7pt 

20 the result with a pubhc key of the organiser (the same public key as in algorithm 501 
or some other), because for security reasons it is advantageous to always have an 
encryption operation as the last operation performed upon a message before 
transmitting it through an otherwise non-secure communications connection. The 
result given by the second algorithm 502 in Fig. 5 is a message from which the outer 

25 authentication can be checked with the public key of the time-stamper. Thereafter 
the time stamp may be checked. Additionally the inner authentication can be 
checked with the pubhc key of the player, and all encryptions can be decrypted with 
the pubhc key(s) of the organiser. 

30 The principles of Fig. 3 and Fig. 5 leave it somewhat open, where actually should 
die time-stamping be performed. Next we will analyse certain possible system 
architectures where different ways and locations of time-stamping are considered. 

Fig. 6 illustrates a system where the main operations that are relevant to off-Une 
35 electronic betting are implemented in a terminal arrangement 600 and a server 610 
operated by the organiser of the betting game. The terminal arrangement 600 
comprises input/output means 601 for providing the user with outputs and for 
accepting inputs from tiie user. Additionally Uie terminal arrangement 600 
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comprises network transceiver means 602 for communicating with other devices 
through a certain network, which most advantageously is a long-distance network 
such as a cellular radio network, wired telephone network, packet-switched 
communications network between computers (like the Internet), a bidirectional 
5 cable television network or a combination of such networks. The terminal comprises 
also a bet record generation block 603 for generating, authenticating and encrypting 
checksum-protected bet records, a clock signal generating block 604 for locally 
generating clock signals, and a time-stamping block 605 for using the generated 
clock signals for time-stamping bet records. There is a connection from the clock 

10 signal generating block 604 to the time-stamping block 605 and between the time- 
stamping block 605 and the bet record generation block 603, as well as between the 
user input/output means 601 and both the network transceiver means 602 and the bet 
record generation block 603. Most advantageously there are no connections from 
the user input/output means 601 to either the clock signal generating block 604 or to 

15 the time-stamping block 605, because the user should not have any control over the 
time-stamping process. 

The practical implementation of the blocks of the terminal 600 is straightforward. 
Most advantageously the terminal resembles the portable communications terminals 

20 known at the priority date of this patent application, so that the user input/output 
means 601 consist of a keypad and a display, the network transceiver means 602 
comprise some transceiver means known from the technology of cellular radio 
systems and/or bidirectional cable television networks, and the bet record generation 
block 603, clock signal generating block 604 and the time-stamping block 605 are 

25 implemented as computer-controlled processes that are executed by a 
microprocessor or a number of microprocessors with eventually some additional 
components like voltage-controlled crystal oscillators. 

The organiser's server 610 comprises a user input/output interface 611 for the 
30 operator who controls the betting on behalf of the organiser, and a network 
transceiver 612 that connects the server to the same network that was mentioned 
above. Additionally the organiser's server 610 comprises a bet record decoding 
block 613 the task of which is to perform all those functions that are needed to 
ensure the authenticity and integrity of a received bet record as well as to check 
35 from the time stamp that the bet was placed in time. An account maintaining block 
614 is responsible for setting up and maintaining the user accounts so that for 
example profits are credited to the winning players' accounts and the placed stakes 
are deducted from the accounts of all participating players. An announcements 
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generation block 615 is responsible for generating both the general broadcast 
announcements to all participating players and the personal messages that are only 
transmitted to individual players or small groups of players. The operator 
input/output interface 611 is bidirectionally connected to all other blocks in order to 
5 give the operator full control of the system. Other connections within the organiser's 
server comprise a chain of connections from the network transceiver 612 through 
the bet record decoding block 613 and the account maintaining block 614 to the 
announcements generation block 615 and back to the network transceiver 612, and a 
connection from the. bet record decoding block 613 to the announcements generation 
10 block 615. 

The operator's input/output interface 611 is most advantageously a keyboard and 
display interface. The network transceiver interface 612 may be any network 
interface available for coupling a heavy-duty network server to a conmiunications 
15 network. The bet record decoding block 613, the account maintaining block 614 and 
the announcements generation block 615 are implemented as computer-controlled 
processes that aie executed by a microprocessor or a number of microprocessors 
with eventually some additional components like voltage-controlled crystal 
oscillators. 

20 

In the system of Fig, 6, the terminal 600 is arranged to transmit in the uplink or 
reverse direction to the organiser's server 610 registration messages and status - 
inquiries that are related to managing the way in which the player takes part in the 
betting. Additionally the terminal 600 transmits to the organiser's server 610 the 
25 actual time-stamped bet records. In the downlink or forward direction the 
organiser's server 610 transmits general broadcast messages which are mostly 
related to the begiiming and end moments of individual betting incidents, as well as 
status reports and other individualised information to individual terminals and/or 
small groups of terminals. 

30 

Fig. 7 illustrates an alternative arrangement where the task of time-stamping is 
entrusted to an intermediary device or link station 710 which conveys all exchange 
of information between a betting terminal 700 and the organiser's server 610. In this 
case the tenninal 700 is simpler than the terminal 600 of Fig. 6: it only comprises 
35 the user input/output interface 601, the network transceiver interface 602' and a bet 
record generation block 603'. Primed reference designators are used because the 
network transceiver interface 602' and the bet record generation block 603' must 
fulfil slightly different operational requirements than in Fig. 6. For example, they 
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must perform the tasks of generating, authenticating and potentially encrypting the 
bet records fast enough to that they make it to the intermediary device 710 before 
the closing time even when the user places his bet with a narrow time marginal left 
before the closing time. The interaiediary device 710 comprises a network 
transceiver interface 711, a clock signal generation block 712 and time-stamping 
means 713 of which the latter is coupled to both other blocks so that a bet record 
received from a terminal may be taken through time-stamping before conveying it 
further to the organiser's server 610. The organiser's server 610 may as such be the 
same as in Fig. 6. 

The principle of using an intermediary device 710 for the time-stamping has the 
inherent advantage that the users are under no circumstances able to tamper with the 
time-stamping procedure (as long as controlling access to the intermediary both 
physically and through the network is suitably restricted). It sacrifices some of the 
advantages of the terminal-based time stamping of Fig. 6 because tlie intermediary 
device must now withstand the potentially very heavy momentary load caused by a 
large number of users making their bets essentially simultaneously. According to the 
principle of off-line electronic betting the intermediary device 710 is well within the 
distributed domain 301 of Fig. 3, meaning that there are numerous intermediary 
devices which in the tree-like structure of the network that links the terminals to the 
central domain are on a rather low level, near the terminal nodes of the tree. This 
way it can be ensured that each individual intermediary device must only handle the 
bet records transmitted by a relatively small number of terminals. For example the 
base stations of cellular radio systems might act as such intermediary devices. 

The task of conveying the time-stamped bet records from the intermediary devices 
further towards the organiser's server is not time-critical any more, because the time 
stamps serve as a proof of the bets having been placed in time even if the time- 
stamped bet records arrive only later to the organiser's server 610, In order to ease 
the processing load of the intermediary devices we may also define that only the bet 
records are conveyed through the intermediary devices and aU other exchange of 
information between the terminal 700 and the organiser's server 610 bypass the 
intermediary device 710 altogether. The intermediary devices must comprise enough 
memory to temporarily store all such bet records which have been received from the 
terminals and time-stamped but which have not yet been communicated further to 
the central domain. 
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The principle of using a device auxiliary to the betting terminal for time-stamping 
can also be applied so that the terminal circulates the bet records through an 
auxiliary device before transmitting them to the organiser's server. Figs. 8a and 8b 
illustrate an*angements that utilize this application of the principle. In Fig. 8a the 
5 organiser's server 610 remains still the same as in Fig. 6, and the terminal 700 is 
basically the same as in Fig. 7. However, the terminal is arranged both to transmit 
bet records without a time stamp through the network to a time-stamper 810 and to 
receive time-stamped bet record from the time-stamper and convey them further to 
the organiser's server 610. The time-stamper 810 has the same functional blocks as 

10 the intermediary device of Fig. 7 but it is only arranged to receive a bet record 
without a time stamp, perform the time-stamping and return the time-stamped bet 
record to the terminal which transmitted it. In Fig. 8b the principle is the same 
except for the fact that the interface between the terminal 800 and the time-stamper 
810' is a local data input/output interface so that the same network which is used for 

15 communication between the terminal and the organiser's server is not used. Several 
local data interfaces ai'e known and appUcable to the purpose of local time-stamping 
according to Fig. 8b; such local data interfaces comprise but are not limited to the 
Bluetooth interface, thelrDA infrared interface, local data network interfaces of die 
Ethernet and Token Ring types and various wireless local loop interfaces. The time- 

20 stamper 810 belongs to the distributed domain, so a suitably large number of time- 
stampers must be provided in order to ensure that none of them is subjected to an 
excessive avalanche of simultaneously transmitted bet records. 



The embodiments of Figs. 6 to 8b have the common feature of locally generating the 
25 clock signal for the purposes of time-stamping in the device which is responsible for 
the time-stamping. The question of making such a time-stamping process tamper- 
proof deserves some consideration. From the technology of protecting integrated 
circuits against unauthorised access there are known several ways of making it at 
least very difficult to affect or even find out the nature of processes performed 
30 within a circuit. An advantageous way of performing the time-stamping for example 
in the arrangement of Fig. 6 is such where both the generation of the clock signal 
and the actual time-stamping take place within a single protected integrated circuit. 
This is illustrated in Fig. 9 where the protected integrated circuit 901 comprises a 
processing block 902. The time-stamping means then that a bet record is input into 
35 the protected integrated circuit 901, and the output of a real time clock 903 located 
within the circuit is combined to the bet record with a cryptographic algorithm, 
which itself is also permanently stored in a read-only memory 904 within the 
protected integrated circuit 901. An unauthorised party does not know the algorithm 
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and can not deduce it by analysing performed time-stampings due to its 
pseudorandom, cryptographic nature. The location of the clock signal source within 
the protected circuit prevents the unauthorised party from using a fake, delayed 
clock signal as an input to the time-stamping process. 
5 Another relatively tamper-proof possibility of using a locally generated clock signal 
is to use such a clock signal for time-stamping, which is also used directly to 
synchronise certain critical operations of the terminal arrangement. For example, a 
terminal arrangement that acts as the terminal of a communications network must 
accomplish several tasks related to the physical level of communicating with the 

10 network in exact sychronism with the network. We may speak about the MAC 
(Media Access Control) functions that govern the terminal's ability of seizing a 
communications channel and using it successfully for communication. If we then 
assume that the clock signal used for time-stamping bet records is the same as some 
real time clock directly related to the MAC functions, we note that tampering with 

15 the clock signal would also change the behaviour of the terminal arrangement in the 
MAC context, which would make it impossible for the temainal arrangement to 
communicate any more with the network. 

It is also possible to use such a clock signal as an input to the time-stamping process 
20 that is completely external to the device performing the time-stamping. Fig. 10 
illustrates a system architecture where the parties essential to the application of off- 
line electronic betting are a terminal 1000 and the organiser's server 1010. The 
terminal 1000 comprises a user input/output interface 601, a network transceiver 
interface 1002, a bet record generation block 603 and time-stamping means 1004. 
25 Of these the user input/output interface 601 and the bet record generation block 603 
can be similar to the corresponding blocks in the system of Fig. 6. The network 
transceiver interface 1002 is arranged to receive not only the announcements and 
status reports from the organiser's server 1010 but also a clock signal, which is 
coupled into the time-stamping means 1004 and used as an input for the time- 
30 stamping process. The difference between the organiser's server 1010 in Fig. 10 and 
that 610 of Fig. 6 is that in Fig. 10 the organiser's server 1010 comprises a clock 
signal generation block 1016, and that the network transceiver interface 1012 of the 
organiser's server is arranged to multiplex the clock signal generated in block 1016 
into the broadcastings which are directed to the terminals. 

35 

Typically the organiser's server is not broadcasting announcements continuously to 
tiie terminals, so the arrangement of Fig. 10 may be considered to have the 
drawback of requiring continuous or at least very frequent broadcastings in order to 
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transmit the clock signal from block 1016 to the terminals frequently enough. Fig. 
11 illustrates an alternative arrangement where the organiser's server 610 is the 
same as previously in Fig. 6, and the clock signal comes from some other 
transmission source 1 120 which comprises a clock signal source 1 122 and, coupled 
5 to its output, suitable transmission means 1121. The terminal 1000 is otherwise the 
same as in Fig. 10 but it may comprise the reception means 1 105 required to receive 
the transmissions of the other transmission source 1120, if the transmissions 
therefrom can not be received through the same transceiver interface 1002 which the 
terminal uses for communicating with the organiser's terminal 610. 

10 

In order to take full advantage of the completely external clock transmission source 
1120 it is advisable to select, as the clock transndssion source 1120, a digital 
transmitter that would produce essentially constant general broadcastings anyway. 
Suitable transmission sources are then for example digital video and digital audio 
15 broadcasting stations as well as the base transceiver stations of such digital cellular 
radio systems that produce essentially continuous or at least very frequent downhnk 
transmissions on a pilot chaimel or a general broadcast channel. 

Again it should be made as difficult as possible for a dishonest user to fake the 

20 clock signal, regardless of the fact that the clock signal now comes from outside of 
the betting terminal. An advantageous way of making it difficult to cheat is to keep 
it secret, what actually constitutes the clock signal. Basically an arbitrary 
combination of bits from an arbitrarily selected broadcast digital bit stream may be 
defined to constitute a clock signal. Such definition of the clock signal may even be 

25 disposable in the sense that one definition is only used for a limited duration of time, 
after which a new definition is announced. Additionally the terminal may be 
required to combine the received auxiliary clock signal to the output of a local real 
time clock with an algorithm which is unknown to the users, permanently stored on 
a protected integrated circuit which itself also performs the time-stamping, and even 

30 changed once in a while (a number of algorithms are permanently stored, so that 
changing means that a new one of them is selected). An example of an 
announcement of the clock signal to be used is then of the form: "For the next XXX 
seconds, use the bits XI to XN from every Pth frame of a digital video broadcasting 
stream on frequency YYY as the clock signal, and combine them with the output of 

35 your local real-time clock through using algorithm Z" (here we assume that XXX, 
XI, XN, P and YYY are positive numerical values and Z is an identifier that 
identifies an algorithm). Fig. 12 illustrates a protected integrated circuit 1201 where 
a processing block 1202 receives as its inputs the bet record to be time-stamped, the 
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digital bit stream that includes the clock signal in some non-public way, and the 
algorithm selection signal. Additionally the processing block 1202 may receive the 
output of a local real-time clock 1203. The algorithms are stored in an on-chip 
memory 1204. 

5 Even if ultimate measures are taken to prevent dishonest users from tampering with 
their terminal arrangements, it may happen that someone manages to change the 
way in which his terminal arrangement operates so that it becomes possible to have 
the terminal arrangement produce and send to the network authentical-looking bet 
records that were generated after the closing time. As a preparatory measure that 

1 0 might uncover attempted cheating it is possible to make the terminal arrangements 
send regular or pseudorandom status messages to some monitoring apparatus that 
can be the same as the organiser's server or some completely other network-coupled 
device. A status message should preferably contain such information the correctness 
and integrity of which is impossible to retain if essential parts of the bet record 

15 generating and time-stamping operations are changed in the terminal arrangement. 
Such information may include, among others, checksums of passages of program 
code as well as snapshot t>pe details like the reading of a clock that should represent 
local real time. The monitoring apparatus checks whether anything suspicious is 
found in the status messages, and reports any discrepancies found to the organiser's 

20 server. 



One possible measure that can be taken against cheating is to require that a 
watchdog algorithm is constantly, regularly or pseudorandomly active in each 
terminal arrangement during the whole time that is relevant for generating and time- 

25 stamping bet records. The watchdog algorithm may itself be an encryption algorithm 
the execution of which is synchronised into a local hardware counter. Changing the 
output frequency of said counter must in that case disable an essential part of the 
terminal arrangement from functioning altogether; for example a frequency direcdy 
related to the MAC functions may be used as the hardware counter. It is also 

30 advantageous if the value of the hardware counter cannot be changed by software 
operations. The encryption-type watchdog algorithm requires a new cryptographic 
key to be supplied to it according to a predefined time schedule, so that a missing or 
wrong key interrupts the operation of the algorithm, which in turn makes it 
impossible to compose, time-stamp and/or transmit any more bet records. This is 

35 what it meant by the algorithm being a watchdog: if it is not functioning properly, 
die whole betting application or at least an essential part of it must fail in the 
terminal arrangement. The keys to the watchdog algorithm come most 
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advantageously through transmissions from the network; they can come for example 
from the organiser's server but this it not a requirement of the invention. 

We will now move on to describing one exemplary betting game as an example of 
5 applying the invention in practice. Fig. 13 illustrates the system architecture, where 
the parties involved are the organiser 1301 of the betting game, a broadcaster 1302 
capable of producing widespread digital broadcastings, a governmental supervisory 
instance 1303, a bank 1304 supporting electronic money transactions and a player 
1305. In a practical situation a very large number of players would be involved, but 
10 in order to describe the application of the present invention it suffices to describe 
the part of one player. Two communications networks are used, namely a packet- 
switched data network 1306 and a digital broadcasting network 1307. The system 
architecture corresponds mainly to that of Fig. 11, 

15 The separation of the packet-switched data network 1306 and the digital - 
broadcasting network 1307 from each other suggests that the former could be for 
example a wireless GPRS (General Packet Radio Services) network and the latter 
could be for example either a wireless or cable-based DAB (Digital Audio ■ 
Broadcasting) or DVB (Digital Video Broadcasting) network. It is possible to use 

20 also other networks. As the packet-switched data network 1306 or instead of it one 
might consider using a more conventional cellular radio network where the 
messages could be transported in data calls and/or SMS (Short Messaging Services) • 
messages, or a PSTN (Public Switched Telephone Network) with appropriate 
modem connections. It is also possible to unite tha networks into e.g. a single 

25 bidirectional digital television network based on wireless and/or cable connections. 

Figs. 14a to 14c illustrate the progress of events and exchange of messages in the 
exemplary betting game. Rounded rectangles illustrate functions performed at a 
certain location, right-angled rectangles illustrate messages transmitted point-to- 

30 point between two locations and jagged rectangles illustrate broadcastings of point- 
to-multipoint type. At step 1401 the player registers himself as a registered player in 
the betting system of the organiser. This is the initial step where both the player and 
the organiser must authenticate themselves to the other party so that secure 
communications connections may be set up therebetween later. At step 1402 the 

35 organiser sets up a user account for the player. We assume that the organiser does 
not allow betting on credit, so at step 1403 the organiser asks the player to make an 
advance payment into his user account. The advance payment is accomplished 
according to some mutually accepted form of making payments. It is possible that 
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the whole procedure of registering and making the advance payment is performed 
over the counter at the organiser's authorised representative, but in Fig. 14a we 
assume that electronic transactions are used. At step 1404 the player instructs the 
bank to transfer money to the organiser; debiting the player's account at the bank is 
5 accomplished at step 1405 and followed by a report from the bank to the organiser 
at step 1406 so that the player's user account at the organiser's betting system can be 
correspondingly credited at step 1407. 

At step 1408 the organiser preliminarily announces the next occasion of a betting 
10 game or a number of betting games. For example, if the invention is apphed to 
implement instant betting on the special events in a soccer game, the announcement 
of step 1408 could be made (even several times) before the beginning of the game. 
It is a broadcast message of point- to-multipoint type, so basically it can be made 
either as a general packet broadcasting in the packet-switched network or through 
15 the digital broadcasting network. This is illustrated in Fig. 14a by showing also a 
dashed hne through the broadcaster as an alternative deUvery route for the message. 
The announcement of step 1408 comprises general information regarding the 
oncoming (number of) betting game(s). In our soccer example the announcement 
could comprise for example an identifier of the match, a list of those special events 
20 that are to be the objects of individual bettings (corners, free kicks, penalty kicks, 
etc.), and Umits for acceptable stakes. The aimouncement of step 1408 may also 
comprise the definition of a guard period, which we will explain in more detail later. 

When the player has received the announcement of step 1408, he has the choice 
25 whether or not to take part in the announced betting game or number of betting 
games. In the case of Fig. 14a the player decides to take part, so at step 1409 he 
transmits his registration for the announced betting game or number of betting 
games. The registration of the player must be authenticated so that the player has 
access to his user account in the organiser's system. The registration message may 
30 comprise for example a maximum limit for the sum of money which the player is 
willing to use in the announced game(s) and the value of a default stake which the 
player wants to use in an individual bet if not otherwise stated later. At step 1410 the 
organiser's system acknowledges the message sent by the player at step 1409. In the 
message of step 1410 the organiser may confirm the balance of the player's user 
35 account and also repeat the information given by the player at step 1409 so that the 
player may check that everything is in order for playing. 
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At step 1411 the organiser announces that a certain individual betting incident has 
begun and the players may start placing bets. The announcement of step 1411 is 
again of point-to-multipoint type. The message of step 1411 may be for example of 
the type shown in Fig. 15. The message 1500 of Fig. 15 comprises a starting time 
5 1501 which means the moment after which the placing of bets is allowed, a match 
identifier 1502 which identifies the higher-level hierarchical concept of which the 
particular incident announced in the message 1500 is a part (e.g. "FC Milan against 

* 

Manchester United on 2 July 2000), an incident identifier 1503 which identifies the 
individual betting incident concerned (e.g. "ManlJ 1^' comer"), an incident 

10 descriptor 1504 which is meant to convey some textual information to the player 
(e.g. '*ManU corner from left on the 12^^ minute: will they score a goal?"), a list 
1505 of the alternative outcomes on which the players may place bets (e.g. *'l: 
Inunediate goal, X: Indirect goal in next 15 seconds, 2: No goal"), the rates 1506 at 
which the players may win at each alternative outcome (e.g. "1: 12.0, X: 7.0, 2: 

15 1.05"), a packet identifier 1507 which may also act as a checksum for checking the 
integrity of the packet, and a definition 1508 of what will constitute the clock signal 
for the current betting incident and which algorithm should be used for time- 
stamping. The last-mentioned is not. necessary if a permanently defined clock and 
algorithm aixangement is used or if the definition of the clock signal and the 

20 selection of algorithm has been given in one of the messages of steps 1408 or 1410. 

In Fig. 14b we assume that a part of a digital bit stream broadcast from the 
broadcaster constitutes the clock signal. Such broadcastings are typically constantly 
on, so there should be a constant flow of clock signals from the broadcaster to the 

25 player in Figs. 14a, 14b and 14c, but for the sake of clarity only the clock signals 
1412 to 1418 are shown in Fig. 14b. Each of these clock signals may be for example 
a certain combination of bits in a transmission frame transmitted by the broadcaster. 
If a watchdog algorithm of the kind described previously is running in the player's 
terminal arrangement, the transmissions 1412 to 1418 in Fig. 14b might contain the 

30 keys needed to keep the watchdog "alive". 

At step 1419 the player places a bet, which means that he makes his selection among 
the alternatives given in the message of step 1411 and gives appropriate commands 
to his terminal, which responds by generating a time-stamped bet record. Depending 
35 on the definition of time-stamping, the terniinal may use various combinations of 
the clock signals 1412 to 1418. The terminal could use for example only the latest 
clock signal 1414, or it and the next subsequent clock signal 1415, or even a 
calculated combination of all clock signals 1412 to 1414 from the reception of the 
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beginning announcement of step 141 1 to the moment when the player places his bet. 
According to the principle of off-line electronic betting the terminal does not need 
to transmit the time-stamped bet record to the organiser inmiediately (although the 
invention does not prevent him from doing so). If some of the embodiments of Figs. 
5 7 to 8b v^ould be used, step 1419 would also comprise the procedure of transmitting 
the bet record to the auxiliary device and time-stamping it there. 
At some later time the incident the outcome of which was the object of betting is 
over, and the outcome becomes known. The moment after which it must be 
impossible to place valid bets is presented in Fig. 14b as the actual closing time 

10 1420. For the sake of example Fig. 14b shows also the attempted placing of a bet at 
step 1421, which is after the actual closing time. The organiser broadcasts an 
announcement of the end of betting at step 1422. However, the concept of guard 
period is applied, so the moment of transmitting the message of step 1422 is not 
decisive: the time for placing vaUd bets ended at moment 1420. The invention does 

15 not require a guard period to be used, and the invention allows the guard period to 
have even a different sign than that shown in Fig. 14b. The latter means that the . 
time for placing valid bets may even continue after the delivery of the message of 
step 1422, so that the message comes first and the actual closing time only 
thereafter. The message of step 1422 may be for example of the type shown in Fig. 

20 16. The message 1600 of Fig. 16 comprises a closing announcement time 1601 
which may be different than the actual closing time and means the moment of 
transmitting the packet 1600, a match identifier 1602 which is the same as match 
identifier 1502 in Fig. 15, an incident identifier 1603 which is the same as the 
incident identifier 1503 in Fig. 15 and a packet identifier 1604 which may also act 

25 as a checksum for the integrity of the packet 1600. The packet 1600 could also 
comprise an announcement of the actual closing time 1420. 

The reception at the user's terminal arrangement of the message that indicates that 
no more bets are allowed should immediately disable the terminal arrangement from 

30 generating any more such bet records related to the closed betting game that could 
under any conditions be interpreted as having been validly time-stamped. This 
should happen regardless of the reading or even availability of a local real time 
clock signal in the terminal arrangement at the moment of receiving the message. 
Such conditionless closing of betting at the terminal arrangement is again a security 

35 measure against cheating attempts that could try e.g. delaying the moment at which 
the betting application in the terminal arrangement realizes that a closing message 
has indeed arrived. 
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At step 1423 the organiser broadcasts the official outcome of the betting incident 
that was closed at step 1422. The message broadcast at step 1423 may be for 
example of the type shown in Fig. 17. The message 1700 of Fig. 17 comprises the 
actual closing time 1701 which refers now to the moment 1420 shown in Fig. 14b, a 
5 match identifier 1702 which is the same as match identifier 1502 in Fig. 15, an 
incident identifier 1703 which is the same as the incident identifier 1503 in Fig. 15, 
the outcome 1704 of the incident which was the object of betting, and a packet 
identifier 1705 which may also act as a checksum for the integrity of the packet 
1700. 

10 

Based on its knowledge about which bets the player did place before the actual 
closing time and which was the actual outcome, the player's terminal calculates at 
step 1424 the expected effect of the betting incident on the player's user account. 
This calculation is preliminary and its purpose is just to anticipate the official 

15 calculation of results so that the player receives inomediate feedback and so that the 
player knows, how much money he has left in his user account for possible 
subsequent betting incidents during the same match. According to one embodiment 
of the invention the terminal generates, and stores an outcome record which may be 
even time-stamped in the same way as the previously mentioned time-stamped bet 

20 record. 

Other betting incidents could now follow so that the procedure of steps 1411 to • 
1424 would be repeated. For the reasons of graphical clarity we assume in Fig. 14b 
that no further betting incidents occur. At step 1425 the organiser announces that the 
25 entity of game(s) that was dealt with at steps 1408 to 1410 has ended. At the same 
time the organiser may announce the deadline for returning the time-stamped bet 
records to the organiser for the official calculation of results. The last-mentioned 
announcement is not needed if the definition of a deadline is constant, like 24 hours 
from the announcement of step 1425. 

30 

As we noted before, the invention does not actually forbid the player's terminal 
from transmitting the time-stamped bet records already earlier to the organiser. 
However, in Fig. 14b we assume that the terminals start transmitting the time- 
stamped bet records only after they have received the message of step 1425. In order 
35 not to make all terminals transmit their time-stamped bet records at the same time, it 
may be required that the terminal applies a certain delay after having received the 
message of step 1425. The length of the delay may be predetermined for each 
terminal, or the terminals may use some random or pseudorandom process to 
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generate individual delay lengths. At step 1426 the terminal transmits the time- 
stamped bet record generated at step 1419 to the organiser, and at step 1427 it 
transmits the same time-stamped bet record to the supervisor. The transnoission of . 
the bet record may be for example of the type shown in Fig. 18. The message 1800 
5 of Fig. 18 comprises a copy of the start packet 1500, a copy of the closing packet 
1600, a copy of the outcome packet 1700, a bet identifier 1804 for identifying an 
individual placed bet, the stake 1 805 placed in the bet (not needed if some default 
stake is used), the bet contents 1806, i.e. the player's guess of the outcome of the 
incident which was the object of betting, the terminal's preliminary calculation 1807 
10 of the player's profits or losses in the bet (i.e. the outcome record, if such was 
generated), a time stamp 1808 which shows the time when the bet was placed, and a 
packet identifier 1809 which may also act as a checksum for the integrity of the 
packet 1900. The time stamp could also be a part of the bet contents field 1806, and 
possibly also a part of the outcome record field 1807. 

15 

At step 1428 the terminal transmits the time-stamped bet record generated at step 
1421 to the organiser, and at step 1429 it transmits the same time-stamped bet 
record to the supervisor. It is. not required that the time-stamped bet records are 
transmitted in different transmissions; indeed, in order to keep the number of 

20 individual transmissions at minimum it may be advantageous to compose a single 
transmission comprising all individually time-stamped bet records. The terminal is 
already aware that the bet record generated at step 1421 was invalid, so it has not 
taken it into account at step 1424 when preliminarily calculating the effect on the 
player's user account, and it also does not place anything related to the invahd bet 

25 into the outcome record field 1807 concerning the terminal's preliminary calculation 
of the player's profits or losses. 

It is questionable, whether the terminal should report at all such bets which were 
placed after the actual closing time and which thus have no effect on the player's 

30 user account. However, it is important to the operation of the betting system that the 
terminal reports all bets which were validly placed between the opening time and 
the actual closing time, because it must not be possible for the player to prevent the 
terminal from reporting those bets which were not successful. According to one 
embodiment of the invention there is within the terminal a protected algorithm 

35 (which may well be the same as or in close connection to the time-stamping 
algorithm) which accumulates a counter each time when a bet is placed and which 
discloses the highest counter value reached before the actual closing time in all 
subsequent transmissions of time-stamped bet records to the organiser and the 
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supervisor. According to that embodiment of the invention the organiser does not 
accept the time-stamped bet records from a certain user unless their number is large 
enough to bring a corresponding counter at the organiser's system to the same value. 

5 At step 1430 the organiser checks all received, time-stamped bet records to make 
sure that it has received complete reports from all those terminals that were 
registered to the game earlier at step 1409. If the deadline expires without a 
complete report having been received from a certain player, the organiser may 
freeze the user account of that player and prevent the player frorn accessing the 

10 betting system again (the reason thereto being the organiser's suspicion about the 
player trying to prevent the transmission of unsuccessful bet records. The checks 
performed at step 1430 comprise also a balance verification check the purpose of 
which is to ensure that a player has not placed a bet with a larger stake than what he 
can afford with the current balance of his user account. After all bet records have 

15 been analysed, the organiser updates the user accounts at step 1431 so that the 
profits are credited to the winning players' accounts and the stakes are deducted 
from the user accounts of all players that placed bets. 

At step 1432. the organiser transmits the final results to the players and to the • 
20 supei-visor. The information regarding betting results is typically confidential, so this 
transmission is of point-to-point type at least logically if not physically. Logical 
point-to-point transmissions in a shared physical broadcasting media of point-to- 
multipoint type can be accompHshed by using codes that are only known to the 
authorised parties. At step 1433 the player's terminal displays the final results to the 
25 player, and at step 1434 the supervisor may compare the final results against the 
transmissions received from the players in order to check that the betting went 
according to applicable regulations. 

At step 1435 the player expresses a wish to log out from the system altogether, 
30 which causes his user account at the organiser's system to be emptied at step 1436 
and the remaining amount of money to be transferred to the user's bank account in 
steps 1437 and 1438. At step 1439 the player receives a balance notice from the 
bank indicating that the transactions have been completed. 

35 Fig. 19 summarises the main functions of the terminal arrangement in executing the 
betting part of the method described above. The term "terminal arrangement" should 
be used, because the invention does not require the terminal to be a single device. 
An exemplary multi-device terminal arrangement may consist of a television set, a 
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set-top-box, a memory module coupled to the set-top-box and a wireless remote 
controller. However, usually the shorter term "terminal" is used for the sake of 
brevity. Registrating as an acknowledged user of a system and setting up an user 
account as well as paying a certain sum to the user account are known as such to the 
5 person skilled in the art, so the functions that relate to steps 1401-1407 in Fig. 14 are 
not illustrated in Fig. 19. 

The loop thi'ough steps 1901 and 1902 constitutes a standby state where the terminal 
waits for the next announcement of oncoming betting game(s). When such an 

10 announcement has arrived, the terminal displays its contents to the user at step 1903. 
If a positive response is received from the user at step 1904, a game registration 
message is produced and transmitted at step 1905; otherwise the terminal returns to 
the standby state. At step 1906 the terminal waits for the game registration message 
to be acknowledged. If the acknowledgement does not come in due time the 

15 terminal assumes that the game registration message has been lost and returns to 
step 1903 for the generation of a new one. 

After the acknowledgement has been received, the terminal goes into the standby 
state constituted by steps 1907 and 1908. When an announcement for the beginning 

20 of a betting incident arrives, its contents are displayed to the user at step 1909. Now 
the user has the choice of betting or not betting. The latter alternative means 
returning from the decision step 1910 to step 1907, while a positive response from 
the user causes a time-stamped bet record to be generated at step 1911. The 
production of a clock signal at step 1912 as input information to step 1911 may take 

25 the form of receiving and processing an extemal clock signal or generating an 
internal clock signal. The generation of further bet records for the same incident is 
possible if before the reception of betting end signal at step 1913 the user gives 
appropriate conunands at step 1914. 

30 After receiving the betting end signal at step 1913 the terminal waits for the 
outcome message at step 1915. When it has arrived, the terminal calculates the 
effect of the outcome and displays it to the user at step 1916. Step 1917 is a check 
for the possible reception of a game end message; if none has been received yet but 
a new betting incident comes up according to step 1918 the terminal returns to step 

35 1909. Although not illustrated in Fig. 19, also overlapping and nested betting 
incidents are allowed in the invention: a new betting incident may be declared open 
before a previous betting incident has been closed, and such a more recentiy opened 
betting incident may even be declared closed before the older one. 



wo 02/27674 PCT/FIOl /00843 

28 

When the game end signal has been received at step 1917, the terminal starts the 
procedures that aim at transmitting the time-stamped bet records to the organiser at 
step 1919. The terminal may apply for example polling at arbitrary time intervals to 
5 check, whether the organiser's system is ready for receiving the time-stamped bet 
record transmission(s). A large number of terminals may be attempting these 
transmissions simultaneously, so an effective collision resolution protocol is needed 
to ensure successful transmission of all bet records. Implementing such collision 
protocols is known as such to the person skilled in the art. After having succeeded in 
10 transnaitting the time-stamped bet records the terminal waits for the final results 
message from the organiser at step 1920 and finally displays the final results to the 
user at step 1921. The steps that relate to the procedures of logging off and cashing 
in the user account are again not shown in Fig. 19, because they are regarded to 
represent technology known as such to the person skilled in the art. 

15 

Fig. 20 illustrates correspondingly the functional steps executed by the organiser's 
system between steps 1407 and 1435 of Fig. 14. At step 2001 the system generates . 
and transmits the announcement and call for game registrations. In the loop . 
constituted by steps 2002 and 2003 the system waits for the game registration period 

20 to end and acknowledges the game registrations it receives. When a betting incident 
comes up, the system transmits the incident begin message at step 2004, and = 
somewhat later it transmits the incident end message at step 2005 and the outcome • 
message at step 2006. At step 2007 it is checked, whether still more incidents will 
take place in the same game. If yes, the system returns to step 2004 and if not, a 

25 game end message is transmitted at step 2008. After that (or even before, as the 
invention does not forbid that) the time-stamped bet records start pouring in. These 
are received and possibly akeady decoded at step 2009; decoding at an early stage is 
advantageous especially if die transmissions contain a checksum and the system 
must acknowledge all transmissions that come in intact as proved by the checksum. 

30 

When the deadline for returning the bet records has been passed (or even before, if 
the betting ratios are fixed so that die contents of the incoming bet records do not 
affect the calculation of profits) the system starts the task of updating user accounts. 
It takes a bet record at step 2010 and checks its time stamp at step 2011. All bet 
35 records that had been generated in time cause the corresponding stake to be 
deducted at step 2012 from the user account of the player who placed the bet. If the 
bet is found at step 2013 to be a winning bet, the profit is calculated at step 2014 
and credited to the corresponding user account at step 2015. Regardless of whether 



wo 02/27674 PCT/FlOl /00843 

29 

steps 2014 and 2015 were executed or not after step 2013, a result report to the 
player is created at step 2016, Even if the bet record was found invalid at step 201 1 
due to not having been time-stamped in time and consequently discarded at step 
2017, a report is most advantageously created at step 2016. Step 2018 is just a check 
5 whether all bet records were handled aheady; if not the system returns to step 2010 
and if yes, the final results are transmitted out at step 2019. 

The above-described exemplary embodiments of the invention should not be 
construed to place limitations to the scope of protection which is defined in the 
10 appended claims. The verb "to comprise'* is used in this patent apphcation as an 
open limitation, meaning that it does not exclude the existence of also other features 
than those explicitly mentioned. The features recited in the depending claims are 
freely combinable unless explicifly otherwise stated. 
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Claims 

1. A method for handling, within a conmiunications system comprising a 
distributed domain (301) and a central domain (303), electronic records that contain 
predictions of the outcome of a certain incident, comprising the steps of: 

5 - generating (304), within the distributed domain (301) and before the outcome of 
the incident is known, a multitude of electronic records that contain predictions of 
the outcome of the incident, 

- conveying (305) the electronic records from the distributed domain (301) to the 
central domain (303) and 

10 - within the central domain (303) and after the outcome of the incident is known, 
finding out (306) which of the electronic records, if any, contain correct predictions 
of the outcome of the incident, 
characterised in that it comprises the steps of: 

- furnishing (304, 401, 502, 902, 1202, 1911), within the distributed domain (301), . 
15 each of the electronic records with a cryptographically protected proof of a certain 

moment of time associated with the veneration of the electronic record and 
-accepting (306, 1430, 2011), within the .central domain (303), only those of the 
electronic records conveyed thereto as valid for which the cryptographically 
protected proof of a certain moment of time associated with the generation of the • 
20 electronic record shows that said certain moment of time was not later in time than a •": 
certain time limit. 

2. A method according to claim 1, characterised in that the step of furnishing 
each of the electronic records with a cryptographically protected proof of a certain 

25 moment of time associated with the generation of the electronic record comprises 
the step of generating a time-stamped electronic record through the application of an 
algorithm (401) which uses the plaintext contents of the electronic record and a 
clock signal as input information. 

30 3. A method according to claim 2, characterised in that it comprises the steps of 
authenticating and encrypting the electronic record by using also a private key of the 
party generating the electronic record and a public key of an intended recipient of 
the time-stamped, authenticated, encrypted electronic record as input information to 
said algorithm (401). 

35 

4. A method according to claim 1, characterised in that the step of furnishing 
each of the electronic records with a cryptographically protected proof of a certain 
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moment of time associated with the generation of the electronic record comprises 
the steps of: 

- generating an authenticated and encrypted electronic record through the 
application of a first algorithm (501) which uses the plaintext contents of the 

5 electronic record, a private key of the party generating the electronic record and a 
public key of an intended recipient of the time-stamped, authenticated, encrypted 
electronic record as input information to said first algorithm and 

- time-stamping the authenticated and encrypted electronic record generated by said 
first algorithm through the appUcation of a second algorithm (502) which 

10 additionally uses a clock signal and a private key of the party performing the time- 
stamping as input information. 

5. A method according to claim 4, characterised in that it comprises, between 
the steps of generating an authenticated and encrypted electronic record and time- 
15 stamping the authenticated and encrypted electronic record, the step of conveying 
the authenticated and encrypted electronic record from a first device which 
generated (501) the authenticated and encrypted electronic record to a second device 
which performs the time-stamping (502). 

20 6. A method according to claim 1, characterised in that it comprises the steps of: 
-generating (603), within a certain device (600) belonging to the distributed 
domain, an electronic record that contains a prediction of the outcome of the 
incident, 

- furnishing (605), within said certain device (600) belonging to the distributed 
25 domain, the generated electronic record with a cryptographically protected proof of 

a certain moment of time associated with the generation of the electronic record, 
thus producing a time-stamped electronic record, 

- conveying (602, 612) the generated and time-stamped electronic record from said 
certain device (600) belonging to the distributed domain to the central domain (610), 

30 - accepting (613), within the central domain (610), the generated and time-stamped 
electronic record as valid on the condition that the cryptographically protected proof 
of a certain moment of time shows that said certain moment of time was not later in 
time than a certain time limit, and 

- within the central domain and after the outcome of the incident is known, if the 
35 generated and time-stamped electronic record was accepted ^s vaUd, finding out 

(613) whether the generated and time-stamped electronic record contains a correct 
prediction of the outcome of the incident. 
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7. A method according to claim 1, characterised in that it comprises the steps of: 

- generating (603'), within a certain first device (700) belonging to the distributed 
domain, an electronic record that contains a prediction of the outcome of the 
incident, 

5 - conveying (602', 711) the generated electronic record from said first device (700) 
belonging to the distributed domain to a second device (710) belonging to the 
distributed domain, 

-furnishing (713), within said second device (710) belonging to the distributed 
domain, the generated electronic record with a cryptographically protected proof of 
10 a certain moment of time associated with the generation of the electronic record, 
thus producing a time-stamped electronic record, 

- conveying (811, 612) the generated and time-stamped electronic record from said 
second device (710) belonging to the distributed domain to the central domain 
(610), 

15 - accepting (613), within the central domain (610), the generated and time-stamped • 
electronic record as valid on the condition that the cryptographically protected proof 
of a certain moment of time shows that said certain moment of time was not later in 
time than a certain time limit, and 

- within the central domain (610) and after the outcome of the incident is known, if 
20 the generated and time-stamped electronic record was accepted as valid, finding out . 

(613) whether the generated and time-stamped electronic record contains a correct . 
prediction of the outcome of the incident. 

8. A method according to claim 1, characterised in that it comprises the steps of: 
25 - generating (603', 603"), within a certain first device (700, 800) belonging to the 

distributed domain, an electronic record that contains a prediction of the outcome of 
the incident, 

-conveying (602', 801, 811, 814) the generated electronic record from said first 
device (700, 800) belonging to ttie distributed domain to a second device (810, 810') 

30 belonging to the distributed domain, 

-furnishing (813), within said second device (810, 810') belonging to the 
distributed domain, the generated electronic record with a cryptographically 
protected proof of a certain moment of time associated with the generation of the 
electronic record, thus producing a time-stamped electronic record, 

35 - conveying (602', 801, 811, 814) the generated and time-stamped electronic record 
from said second device (810, 810') belonging to the distributed domain back to 
said first device (700, 800) belonging to the distributed domain. 
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- conveying (602, 602', 612) the generated and time-stamped electronic record from 
said first device (700, 800) belonging to the distributed domain to the central 
domain (610), 

- accepting (613), within the central domain (610), the generated and time-stamped 
5 electronic record as valid on the condition that the cryptographically protected proof 

of a certain moment of time shows that said certain moment of time was not later in 
time than a certain time limit, and 

- within the central domain (610) and after the outcome of the incident is known, if 
the generated and time-stamped electronic record was accepted as vaUd, finding out 

10 (613) whether the generated and time-stamped electronic record contains a correct 
prediction of the outcome of the incident. 

9. A method according to claim 1, characterised in that the step of furnishing 
each of the electronic records with a cryptographically protected proof of a certain . 

15 moment of time associated with the generation of the electronic record comprises 
the substeps of: 

- generating a clock signal (903) witliin a protected integrated circuit (901), 

- receiving an electronic record into said protected integrated circuit (901), 

- furnishing (902) said electronic record with a cryptographically protected proof of 
20 a certain moment of time through the application of an algorithm read from a 

storage location (904) within said protected integrated circuit (901) and using said 
clock signal (903) generated within said protected integrated circuit, and 

- outputting the electronic record furnished with a cryptographically protected proof 
of a certain moment of time from said protected integrated circuit (902). 

25 

10. A method according to claim 1, characterised in that the step of furnishing 
each of the electronic records with a cryptographically protected proof of a certain 
moment of time associated with the generation of the electronic record comprises 
the substeps of: 

30 - receiving an external clock signal into a protected integrated circuit (1201), 

- receiving an electronic record into said protected integrated circuit (1201), 

- furnishing (1202) said electronic record with a cryptographically protected proof 
of a certain moment of time through the application of an algorithm read from a 
storage location (1204) within said protected integrated circuit (1201) and using said 

35 clock signal received into said protected integrated circuit (1201), and 

- outputting the electronic record furnished with a cryptographically protected proof 
of a certain moment of time from said protected integrated circuit (1201). 
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11. A method according to claim 10, characterised in that it additionally 
comprises the step of receiving a local real time clock signal (1203) into said 
protected integrated circuit (1201), so that said step of furnishing (1202) said 
electronic record with a cryptographically protected proof of a certain moment of 
5 time takes place through the application of an algorithm read from a storage location 
(1204) within said protected integrated circuit (1201) and using both said external 
clock signal received into said protected integrated circuit (1201) and said local real 
time clock signal (1203) received into said protected integrated circuit (1201). 

10 12. A method according to claim 11, characterised in that the step of receiving a 
local real time clock signal (1203) into said protected integrated circuit (1201) 
comprises the step of receiving into said protected integrated circuit (1201) a clock 
signal that is simultaneously used for synchronising at least one operation belonging 
to a category of Media Access Control operations. 

15 

13. A method according to claim 1, characterised in that it comprises the steps of: 

a) tx'ansmitting a begin signal (1411) from the central domain to the distributed 
domain, 

b) generating (1419, 1421), within the distributed domain, a number of electronic 
20 records each furnished with a cryptographically protected proof of a certain moment 

of time associated with the generation of the electronic record, 

c) transmitting an end signal (1422) from the central domain to the distributed 
domain, and 

d) transmitting from the distributed domain to the central domain the electronic 
25 records (1426, 1428) generated before the reception of said end signal (1422). 

14. A method according to claim 13, characterised in that it comprises, after step 
c) but before step d), the step of: 

cl) transmitting an outcome signal (1423) from the central domain to the distributed 
30 domain. 

15. A method according to claim 14, characterised in that comprises, after step 
cl), the step of 

c2) calculating (1424), within a certain device belonging to the distributed domain, a 
35 preliminary betting result on the basis of the received outcome signal and the 
electronic records generated at step b) in said certain device belonging to the 
distributed domain. 



wo 02/27674 PCT/FIOl/00843 

35 

16. A method according to claun 13, characterised in that it comprises, after step 
c) but before step d), the step of: 

c3) ti-ansmitting a game closed signal (1425) from the central domain to the 
distributed domain; 

5 so that step d) is only performed as a result to receiving said game closed signal 
(1425) within the distributed domain. 

17. A method according to claim 13, characterised in that it comprises, before 
step a), the steps of registering (1401) a number of users of terminal arrangements 

10 belonging to the distributed domain as registered users of a betting system belonging 
to the central domain and setting up (1402) at the central domain a user account for 
each registered user. 

18. A method according to claim 13, characterised in that it comprises, before 
15 step a), the steps of: 

-transmitting from the central domain to the distributed domain a prehminary 
announcement (1408) of an oncoming begin signal, and 

- responding to such a prehminary announcement within the distributed domain by 
transmitting to the central domain messages (1409) indicating the wiUingness of . 

20 reacting to such a begin signal by generation of electronic records. 

19. A method for handling, within a terminal arrangement that belongs to the - 
distributed domain of communications system comprising a distributed domain and 
a central domain, electronic records that contain predictions of the outcome of a 

25 certain incident, comprising the steps of: 

- generating (191 1) an electronic record that contains a prediction of the outcome of 
the incident and 

- transmitting (1919) the electronic record to the central domain; 
characterised in that it comprises the step of: 

30 -furnishing (1911) the electronic record, before transmitting it to the central 
domain, with a cryptographically protected proof of a certain moment of time 
associated with the generation of the electronic record. 

20. A method according to claim 19, characterised in that it comprises the steps 
35 of: 

- locally generating a clock signal (604, 903,1912), 

- locally generating an electronic record (603, 1911) and 
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-using the locally generated clock signal (604, 903,1912), the locally generated 
electronic record (603, 1911) and a cryptographic algorithm (401, 904) to generate a 
time-stamped electronic record. 

5 21. A method according to claim 20, characterised in that it additionally 
comprises the step of using said locally generated clock signal (604, 903, 1912) also 
for synchronising at least one operation belonging to a category of Media Access 
Control operations. 

10 22. A method according to claim 19, characterised in that it comprises the steps 
of: 

- receiving an external clock signal (1016, 1122), 

- locally generating an electronic record (603) and 

-using the received external clock signal (1016, 1122), the locally generated 
15 electronic record (603) and a cryptographic algorithm (1204) to generate a time- . 
stamped electronic record. 

23. A method according to claim 22, characterised in that it comprises the steps . 
of 

20 - receiving an external digital bit stream and 

- extracting a number of bits from the received external digital bit stream to be used . 
as said received external clock signal. 

24. A method according to claim 23, characterised in that the step of receiving an 
25 external digital bit stream comprises the step of receiving a digital radio signal of 

the Digital Audio Broadcasting format. 

25. A method according to claim 23, characterised in that the step of receiving an 
external digital bit stream comprises the step of receiving a digital radio signal of 

30 the Digital Video Broadcasting format. 

26. A method according to claim 19, characterised in that it comprises the steps 
of: 

a) receiving a preliminary announcement (1408, 1902) of an oncoming begin signal, 
35 b) as a response to a positive response (1904) from a user, transmitting to the central 
domain a game registration message (1409, 1905) indicating willingness to take part 
in a certain game the beginning of which is to be marked by said oncoming begin 
signal. 
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c) receiving the begin signal (1411. 1908) meant by said preliminary announcement, 

d) as a response to a positive response (1910) from the user, generating an electronic 
record (1419, 1421, 1911) that contains a prediction of the outcome of an incident 
and furnishing the electronic record with a cryptographically protected proof of a 

5 certain moment of time associated with the generation of the electronic record, 

e) receiving an end signal (1422, 1913), 

f) receiving an outcome signal (1423, 1915), 

g) on the basis of the received outcome signal (1423, 1915) and the contents of said 
prediction of the outcome of the incident, calculating and displaying (1424, 1916) a 

10 preliminary result, 

h) receiving a game closed signal (1425, 1917), 

i) transmitting (1426, 1428, 1919) the electronic record generated at step d) to the 
central domain, 

j) receiving a final results message (1432, 1920) and 

15 k) on the basis of the contents of said final results message, displaying (1433, 1921) . 
a final result. 

27. A method according to claim 26, characterised in that step i) comprises the 
step of transmitting to the central domain, together with the electronic record (1806) 

20 generated at step d), copies of said begin signal (1500), said end signal (1600), said 
outcome signal (1700) and said prehminary result ( 1 807). 

28. A computer program product directly loadable into the internal memory of a 
digital computer, characterised in that it comprises software code portions for 

25 performing the steps of claim 19 when said product is run on a computer. 

29. A computer program product stored on a computer usable medium, 
characterised in that it comprises computer readable program means for causing a 
computer to perform the steps of claim 19 when said product is run on a computer 

30 

30. A method for handling, within a computer system tiiat belongs to the central 
domain of a communications system comprising a distributed domain and a central 
domain, electronic records that contain predictions of the outcome of a certain 
incident, comprising the steps of: 

35 - receiving (1426, 1428, 2009) from the distributed domain a multitude of electronic 
records that contain predictions of the outcome of the incident and 
- after the outcome of the incident is known, finding out (1430, 2013) which of the 
electronic records, if any, contain correct predictions of the outcome of the incident. 
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characterised in that it comprises the step of: 

-accepting (1430, 2011) only those of the electronic records received from the 
distributed domain as valid for which a cryptographically protected proof of a 
certain moment of time associated with the generation of the electronic record 
5 shows that said certain moment of time was not later in time than a certain time 
limit. 

31. A method according to claim 30, characterised in that it comprises the steps 
of: 

10 a) transmitting a preliminary announcement (1408, 2001) of an oncoming begin 
signal, 

b) as a response to game registration messages (1409, 2002) received from the 
distributed domain and indicating willingness to take part in a certain game the 
beginning of which is to be marked by said oncoming begin signal, registrating each 

15 user who transmitted a game registration message as a participant in said game, 

c) transmitting the begin signal (1411, 2004) meant by said preliminary 
announcement, 

d) transmitting an end signal (1422, 2005), 

e) transmitting an outcome signal (1423, 2006), 
20 f) transmitting a game closed signal (1425, 2008), 

g) receiving a number of transmissions (1426, 1428, 2009) from the distributed ^ 
domain, 

h) finding out (1430), which of said transmissions from the distributed domain were 
electronic records that contained validly placed predictions of the outcome of the 

25 incident, 

i) of the received electronic records that contained validly placed predictions of the 
outcome of the incident, finding out (1430, 2013), which of them contained 
successful predictions, 

j) debiting (1431, 2012) the price for participating in said game from certain user 
30 accounts of those registered participants in said game from which there were 
received electronic records that contained validly placed predictions of the outcome 
of the incident, 

k) crediting (1431, 2014, 2015) certain profits to certain user accounts of those 
registered participants in said game from which there were received electronic 
35 records that contained successful and validly placed predictions of the outcome of 
the incident, and 

1) transmitting a final results signal (1432, 2019) that represents the debiting and 
crediting operations performed at steps j) and k). 
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32. A method according to claim 31, characterised in that it comprises the steps 
of 

- checking (1430), whether transmissions were received at step g) from all those 
5 participants from which game registration messages were received at step b), and 

- indicating as suspicious those participants from which game registration messages 
were received at step b) but transmissions were not received at step g). 

33. A computer program product directly loadable into the internal memory of a 
10 digital computer, characterised in that it comprises software code portions for 

performing the steps of claim 30 when said product is run on a computer. 

34. A computer program product stored on a computer usable medium, 
characterised in diat it comprises computer readable program means for causing a 

15 computer to perform the steps of claim 30 when said product is run on a computer., 

35. A terminal arrangement (600, 700, 800, 1000) for handling electronic records . 
that contain predictions of the outcome .of a certain incident, comprising: 

- bet record generation means (603, 603', 603") for generating an electronic record 
20 that contains a prediction of ttie outcome of the incident and 

- transmitter means (602, 602', 1002) for transmitting the electronic record to a v . 
central domain; 

characterised in that it comprises: 

- means (604, 605, 1004, 1004', 1105) for furnishing the electronic record, before 
25 transmitting it to the central domain, with a cryptographically protected proof of a 

certain moment of time associated with the generation of the electronic record. 

36. A terminal arrangement according to claim 35, characterised in that it 
comprises 

30 - a protected integrated circuit (901), 

- within said protected integrated circuit (901) an internal clock signal source (903), 

- within said protected integrated circuit (901) a memory (904) for storing an 
algorithm and 

- within said protected integrated circuit (901) means (902) for using said algorithm 
35 to cryptographically combine the output of said internal clock signal source (903) to 

an electronic record that contains a prediction of the outcome of a certain incident. 
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37. A terminal arrangement according to claim 35, characterised in that it 
comprises 

- a protected integrated circuit (1201), 

-receiver means (1002, 1105) for receiving an external clock signal, said receiver 
5 means being coupled to said protected integrated circuit (1201), 

- within said protected integrated circuit (1201) a memory (1204) for storing an 
algorithm and 

-within said protected integrated circuit (1201) means (1202) for using said 
algorithm to cryptographically combine said extemal clock signal to an electronic 
10 record that contains a prediction of the outcome of a certain incident 

38. A terminal arrangement according to clami 35, characterised in that it 
comprises 

- a protected integrated circuit (1201), 

15 - transceiver means (602,1002, 1105) for conmiunicating with a device belonging to 
said central domain, said transceiver means being arranged to perform operations 
belonging to a category of Media Access Control operations and said transceiver 
means being coupled to said protected integrated . circuit (1201) for providing said 
protected integrated circuit (1201) with a clock signal that said transceiver means is 

20 also arranged to use for synchronising at least one operation belonging to said 
category of Media Access Control operations, 

- within said protected integrated circuit (1201) a memory (1204) for storing an 
algorithm and 

-within said protected integrated circuit (1201) means (1202) for using said 
25 algorithm to cryptographically combine a clock signal received from said 
transceiver means to an electronic record that contains a prediction of the outcome 
of a certain incident. 

39. A computer system (610, 1010) for handling, within die central domain of a 
30 communications system comprising a distributed domain and a central domain, 

electronic records that contain predictions of the outcome of a certain incident, 
comprising: 

- receiver means (612, 1012) for receiving from the distributed domain a multitude 
of electronic records that contain predictions of the outcome of the incident and 

35 - processing means (613) for finding out, after the outcome of the incident is known, 
which of the electronic records, if any, contain correct predictions of the outcome of 
the incident, 

characterised in that it comprises: 
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- discriminating means (613) for accepting only those of the electronic records 
received from the distributed domain as valid for which a cryptographically 
protected proof of a certain moment of time associated with the generation of the 
electronic record shows that said certain moment of time was not later in time than a 

5 certain time limit. 

40. An arrangement for handling, within a communications system that comprises 
a distributed domain and a central domain, electronic records that contain 
predictions of the outcome of a certain incident, comprising: 

10 - within the distributed domain means (603, 603', 603") for generating, before the 
outcome of the incident is known, a multitude of electronic records that contain 
predictions of the outcome of the incident, 

- means (602, 602\ 612, 710, 711, 1002, 1012) for conveying the electronic records 
from the distributed domain to the central domain and 

15 - within the central domain means (613) for finding out, after the outcome of the 
incident is known, which of the electronic records, if any, contain correct 
predictions of the outcome of the incident, 
characterised in that it comprises: 

- within the distributed domain means (604, 605, 712, 713, 812, 813, 1004, 1004', . 
20 1105) for furnishing each of the electronic records with a cryptographically 

protected proof of a certain moment of time associated with the generation of the . 
electronic record and 

- within the central domain means (603) for accepting only those of the electronic 
records conveyed thereto as valid for which the cryptographically protected proof of 

25 a certain moment of time associated with the generation of the electronic record 
shows that said certain moment of time was not later in time than a certain time 
Umit. 

41. An arrangement according to claim 40, characterised in that it comprises 

30 - a packet-switched data network (1306) for conveying point-to-point transmissions 
between the central domain and the distributed domain and 

- a digital broadcasting network (1307) for conveying point-to-multipoint 
broadcastings from the central domain to flie distributed domain. 

35 42. An arrangement according to claim 41, characterised in that it comprises 

-within the central domain a central computer system (1301) for handling the 
transmissions between the central domain and the distributed domain through said 
packet-switched data network (1306) and 



wo 02/27674 



PCT/FIOl/00843 



42 

- within the central domain, apart from said central computer system (1301) but 
having a communications connection thereto, a broadcasting arrangement (1302) for 
handling the point-to-multipoint broadcastings from the central domain to the 
distributed domain. 

43. An arrangement according to claim 42, characterised in that said broadcasting 
arrangement (1302) is a Digital Audio Broadcasting transnutter arrangement. 

44. An arrangement according to claim 42, characterised in that said broadcasting 
an'angement (1302) is a Digital Video Broadcasting transmitter arrangement. 
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